How else would they know it is a bot if they didn’t perform a captcha check? There are already ways (Crowdsec and bcp38) to bounce away/deny questionable IP addresses. But malicious actors will just keep spoofing their domains/ip addresses until they get lucky.
1 Like
Define this.
The minute you say well this is my user agent that’s not a bot… Guess what then they use that agent
An agent attaching to your install is a valid connection. (ask me how I know, I wrote ZenOS/Friday) Again they can’t tell until the auth fail.
1 Like
In my case the user agent shows:
(Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot))
In the other users case it was:
(anthropic-ai)
Yes and when my Claude account attaches to my Nabu account then it uses that agent
My OAI one says it’s OAI…
…again. It’s a Valid user agent.
Your choice is
- not use external.
- Harden somehow that prevents connection using something like a VPN.
- accept this is normal and move along.
2 Likes
I’ll go with a vpn then, cool thanks.
2 Likes
Please, someone explain how these bots can even reach users’ HA installations at Nabu. I don’t understand it. Surely, it wouldn’t be enough for such a bot to try a random IP address/port, to end up on a HA installation exposed via Nabu, right? They would first need to guess the exact domain address, assigned to this user, right? But I imagine, these public addresses should be virtually impossible to guess. So how?
They’re not guessing. They’re bots - they can afford to try every possible address combination until they land on a genuine one
1 Like
I see. I’m wondering if increasing the length of these addresses wouldn’t help. Google says that the maximum length of a domain name is 253 characters, while a single segment (between dots) is 63 characters. Therefore, assuming only 63 as the address space and 36 alphanumeric characters to use, the number of possibilities is (I believe) 36^63. An absurdly large number; the chance of a bot hitting any existing address is so small that trying is pointless.
Another possibility is that these addresses are simply leaking, and then the first suspect would probably be a misconfigured or malicious DNS server?
Check out the most recent release notes; there’s an update that helps with this! You can now see the IP, and we’d recommend using the IP Ban feature if you’re seeing certain addresses really giving your system trouble.
1 Like